ima: fail file signature verification on non-init mounted filesystems

FUSE can be mounted by unprivileged users either today with fusermount
installed with setuid, or soon with the upcoming patches to allow FUSE
mounts in a non-init user namespace.

This patch addresses the new unprivileged non-init mounted filesystems,
which are untrusted, by failing the signature verification.

This patch defines two new flags SB_I_IMA_UNVERIFIABLE_SIGNATURE and
SB_I_UNTRUSTED_MOUNTER.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Seth Forshee <seth.forshee@canonical.com>
Cc: Dongsu Park <dongsu@kinvolk.io>
Cc: Alban Crequy <alban@kinvolk.io>
Acked-by: Serge Hallyn <serge@hallyn.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>

2 files changed, 16 insertions, 1 deletions

diff --git a/include/linux/fs.h b/include/linux/fs.h
index c6baf767619e..d9e60824c374 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1321,6 +1321,8 @@ extern int send_sigurg(struct fown_struct *fown);
 
 /* sb->s_iflags to limit user namespace mounts */
 #define SB_I_USERNS_VISIBLE             0x00000010 /* fstype already mounted */
+#define SB_I_IMA_UNVERIFIABLE_SIGNATURE 0x00000020
+#define SB_I_UNTRUSTED_MOUNTER          0x00000040
 
 /* Possible states of 'frozen' field */
 enum {
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 1b177461f20e..4bafb397ee91 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -302,7 +302,19 @@ int ima_appraise_measurement(enum ima_hooks func,
         }
 
 out:
-        if (status != INTEGRITY_PASS) {
+        /*
+         * File signatures on some filesystems can not be properly verified.
+         * On these filesytems, that are mounted by an untrusted mounter,
+         * fail the file signature verification.
+         */
+        if ((inode->i_sb->s_iflags &
+            (SB_I_IMA_UNVERIFIABLE_SIGNATURE | SB_I_UNTRUSTED_MOUNTER)) ==
+            (SB_I_IMA_UNVERIFIABLE_SIGNATURE | SB_I_UNTRUSTED_MOUNTER)) {
+                status = INTEGRITY_FAIL;
+                cause = "unverifiable-signature";
+                integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, filename,
+                                    op, cause, rc, 0);
+        } else if (status != INTEGRITY_PASS) {
                 if ((ima_appraise & IMA_APPRAISE_FIX) &&
                     (!xattr_value ||
                      xattr_value->type != EVM_IMA_XATTR_DIGSIG)) {
@@ -319,6 +331,7 @@ out:
         } else {
                 ima_cache_flags(iint, func);
         }
+
         ima_set_cache_status(iint, func, status);
         return status;
 }